Privacy / GDPR (ILM)
Data map, 30-day DSAR deadlines, export PDF+JSON, erase modes (anonymize / block / schedule delete), retention, consent and blocked-record purge.
Where
Profile menu → Privacy (GDPR) (/privacy/data-subject-requests).
Permissions: settings.privacy_requests.read / create / update / approve / delete.
Tabs: Requests, Data map, Retention, Consent, Blocked.
Data map
Read-only catalog of personal-data stores Orka knows about (users, employees, partners, CRM, applicants, consent, audit, attachments) — modules, fields, default retention days and erase action. Retention policies are seeded from this map the first time you open Retention.
Requests (DSAR)
Every request gets a 30-day due date from creation. Open overdue rows are flagged.
Export (access)
- New request → Export → subject type → search → select → optional reason → Create & submit.
- Approver Approves (processing runs immediately).
- Download the ZIP:
subject_export.pdf+subject_data.json+manifest.json(full inventory: primary subject, linked hits across modules, consents, blocks, retention snapshot).
Erase
Same flow with Erase. Choose a mode:
| Mode | Effect |
|---|---|
| Anonymize | Scrub personal fields and attachments now; keep codes / ledger FKs. |
| Block | Soft-hide from ops; create a blocked record; schedule purge from the category retention policy. |
| Schedule delete | Block immediately; residual purge when retention expires (or Purge now on Blocked). |
Cross-module linked hits (same email / identity) are processed together. Ledger masters are never hard-deleted — applicants (and similar short-retention stores) may be.
Legal hold on a request blocks erase until cleared.
Retention
Per-category days and erase action (anonymize / block / hard_delete). Edit to match your DPA; inactive policies are ignored for new erasures.
Consent
Manual register of marketing / portal / careers / cookies / other grants. Revoke or delete as needed. Export packages include matching consent rows by email.
Blocked & purge
Blocked rows from erase/ILM show status and scheduled purge date. A nightly job (Privacy::PurgeDueBlockedRecordsJob) purges due rows; approvers can Purge now.
Related
- Activity & audit — who ran the request.
- Team, roles & permissions — who can approve.